4 ms·

Thank you for this comment. I for one would be pretty pissed if a "hacker" decided to crash my/or my kids entertainment on a long flight. There is definitely a

by S_A_P 9y ago

Thank you for this comment. I for one would be pretty pissed if a "hacker" decided to crash my/or my kids entertainment on a long flight. There is definitely a need for this type of work, but doing so in a 50,000 lb brick floating a few miles above the ground isn't an atmosphere I am comfortable with, especially if I am present...

d_somewhere 9y ago
You're sitting in a chair in the sky. https://www.youtube.com/watch?v=oTcAWN5R5-I https://www.youtube.com/watch?v=oTcAWN5R5-I
jgrahamc 9y ago
Oh, I agree. There's definitely a need for this type of thing. The work of white hats is essential.
bonzini 9y ago
If anything were to happen, it definitely shouldn't affect the avionics, not even remotely, or the plane would not have had a chance of certification. Data to the less secure IFE had better flow through a unidirectional network ("data diode"), and/or use a separate set of sensors. Even if it brought down the server, it's still nothing that the flight attendants can't solve by "turning it off and back on". This kind of fault happens all the time. More interesting to me is the level of isolation of the network. Could someone exploit my phone through the in-flight WiFi, for example?
- everdev 9y ago
  Accidents happen. Commenter below referenced Swiss Air 111: https://en.m.wikipedia.org/wiki/Swissair_Flight_111 https://en.m.wikipedia.org/wiki/Swissair_Flight_111 They cite inadequate safety standards and an overheating entertainment system. It's easy to assume that government or the airlines wouldn't allow a faulty system to fly, but just like software it's those extreme edge cases that cause problems. Somehow I doubt hacking the entertainment system is comprehensively covered in the manufacturers safety check. It's probably a remote chance something bad would happen, but we can't say it's 0.
  - tptacek 9y ago
    This keeps getting cited on this thread. The IFE didn't simply "overheat". It had faulty wiring. The coffee maker could just as easily have caused that accident.
    - tlb 9y ago
      Lots of things have faulty wiring, but they keep working as long as their power draw is under some limit. Drawing excess power is a common result of software going into an infinite loop, which is a possible outcome of security probes. Half the bugs I notice in Chrome, I notice because my laptop fan starts running.
      - ricardobeat 9y ago
        A CPU overheating is still completely different from the wiring or other components heating up. It is entirely monitored, can throttle itself or shut down through OOB controls. It's more likely for your plane to be hit by a falling unicorn than you being able to burn something up just by the power of `while (1)`.
        jordz 9y ago
        This genuinely made me laugh out loud.
      - AnimalMuppet 9y ago
        Sure. Hair dryers draw excess power when you drop them in a bathtub. Ground-fault protection outlets are supposed to prevent that. If they don't, the outlet is faulty. The origin of Murphy's Law was in a rocket sled project. This guy was strapped onto a rocket sled, fired down a track, and then subjected to strong braking forces. "If anything can go wrong, it will go wrong" didn't just mean "stuff happens". It meant, "you have to either make it impossible for it to go wrong, or you have to find a way that, even if it does go wrong, this guy doesn't die". You can't just ignore the problem as unlikely. It will happen sooner or later. You don't get to say "lots of things have faulty wiring". Things that can kill you had better not have faulty wiring, or had better be able to survive it if they do.
- S_A_P 9y ago
  I agree that, in theory, at least the avionics shouldn't be accessible from the IFE. I am sure there is a rigorous protocol for making sure this is properly secured and certification for airworthiness. I think the parent comment was more making the point that we don't need a flight full of people scanning ports for fun and profit, and the consequences of doing so are unknown and could lead to things like no wifi or IFE on the flight you're on and hopefully not worse
  - qubex 9y ago
    This is obscurantism. Port-scanning a networked system, even aggressively, must be considered typical environmental hazards that any network-attached system must be able to weather (preferably with no degradation in service).
    - mulmen 9y ago
      The point is not that the system is fine, the point is that the method used to identify the flaw is dangerous. This needs to be fixed but the ends do not justify the means.
  - dkersten 9y ago
    > I am sure there is a rigorous protocol The "rigorous protocol" is one-way hardware diodes. The telemetry simply cannot physically travel the other way. Now, of course, there can always be mistakes. Certification is supposed to catch that, but of course, that isn't fool proof either.
- forapurpose 9y ago
  > If anything were to happen, it definitely shouldn't affect the avionics, not even remotely, or the plane would not have had a chance of certification. Is that based on expectation, hope, or knowledge?
  - tjr 9y ago
    In-flight entertainment would be categorized as DO-178B Level E software and DO-254 Level E hardware: https://en.wikipedia.org/wiki/DO-178B#Software_level https://en.wikipedia.org/wiki/DO-178B#Software_level https://en.wikipedia.org/wiki/DO-254 https://en.wikipedia.org/wiki/DO-254 By definition, it should have no impact on "safety, aircraft operation, or crew workload". Mistakes can happen, but this is what is aimed for.
- mseebach 9y ago
  > definitely shouldn't affect the avionics No, and the flaw you're busy exploiting also definitely shouldn't be there. (Yes, the IFE is probably airgapped. Probably.)
  - bonzini 9y ago
    Since when are web servers DO-178 certified?
    - mseebach 9y ago
      Wild guess: Roughly about the time they began being used in IFE systems?
      - bonzini 9y ago
        Not at levels A-D, which are the ones where the faults "should not be there" (citing the parent comment). At level E you only have to prove that there's no effects of faults on safety-critical systems, so it's more about the surrounding architecture than the software itself.
  - ricardobeat 9y ago
    What flaw? He was merely querying a public http API and scanning for ports.
- mulmen 9y ago
  The only way to know that you won't crash a critical system is to try it. You're right you shouldn't be able to but that doesn't mean it can't be done. Doing this in flight is still dangerous.
Tuxer 9y ago
500k lb, at the very least :)

by S_A_P 9y ago

d_somewhere 9y ago

You're sitting in a chair in the sky. https://www.youtube.com/watch?v=oTcAWN5R5-I https://www.youtube.com/watch?v=oTcAWN5R5-I

jgrahamc 9y ago

Oh, I agree. There's definitely a need for this type of thing. The work of white hats is essential.

bonzini 9y ago

If anything were to happen, it definitely shouldn't affect the avionics, not even remotely, or the plane would not have had a chance of certification. Data to the less secure IFE had better flow through a unidirectional network ("data diode"), and/or use a separate set of sensors. Even if it brought down the server, it's still nothing that the flight attendants can't solve by "turning it off and back on". This kind of fault happens all the time. More interesting to me is the level of isolation of the network. Could someone exploit my phone through the in-flight WiFi, for example?

everdev 9y ago
Accidents happen. Commenter below referenced Swiss Air 111: https://en.m.wikipedia.org/wiki/Swissair_Flight_111 https://en.m.wikipedia.org/wiki/Swissair_Flight_111 They cite inadequate safety standards and an overheating entertainment system. It's easy to assume that government or the airlines wouldn't allow a faulty system to fly, but just like software it's those extreme edge cases that cause problems. Somehow I doubt hacking the entertainment system is comprehensively covered in the manufacturers safety check. It's probably a remote chance something bad would happen, but we can't say it's 0.
- tptacek 9y ago
  This keeps getting cited on this thread. The IFE didn't simply "overheat". It had faulty wiring. The coffee maker could just as easily have caused that accident.
  - tlb 9y ago
    Lots of things have faulty wiring, but they keep working as long as their power draw is under some limit. Drawing excess power is a common result of software going into an infinite loop, which is a possible outcome of security probes. Half the bugs I notice in Chrome, I notice because my laptop fan starts running.
    - ricardobeat 9y ago
      A CPU overheating is still completely different from the wiring or other components heating up. It is entirely monitored, can throttle itself or shut down through OOB controls. It's more likely for your plane to be hit by a falling unicorn than you being able to burn something up just by the power of `while (1)`.
      - jordz 9y ago
        This genuinely made me laugh out loud.
    - AnimalMuppet 9y ago
      Sure. Hair dryers draw excess power when you drop them in a bathtub. Ground-fault protection outlets are supposed to prevent that. If they don't, the outlet is faulty. The origin of Murphy's Law was in a rocket sled project. This guy was strapped onto a rocket sled, fired down a track, and then subjected to strong braking forces. "If anything can go wrong, it will go wrong" didn't just mean "stuff happens". It meant, "you have to either make it impossible for it to go wrong, or you have to find a way that, even if it does go wrong, this guy doesn't die". You can't just ignore the problem as unlikely. It will happen sooner or later. You don't get to say "lots of things have faulty wiring". Things that can kill you had better not have faulty wiring, or had better be able to survive it if they do.
S_A_P 9y ago
I agree that, in theory, at least the avionics shouldn't be accessible from the IFE. I am sure there is a rigorous protocol for making sure this is properly secured and certification for airworthiness. I think the parent comment was more making the point that we don't need a flight full of people scanning ports for fun and profit, and the consequences of doing so are unknown and could lead to things like no wifi or IFE on the flight you're on and hopefully not worse
- qubex 9y ago
  This is obscurantism. Port-scanning a networked system, even aggressively, must be considered typical environmental hazards that any network-attached system must be able to weather (preferably with no degradation in service).
  - mulmen 9y ago
    The point is not that the system is fine, the point is that the method used to identify the flaw is dangerous. This needs to be fixed but the ends do not justify the means.
- dkersten 9y ago
  > I am sure there is a rigorous protocol The "rigorous protocol" is one-way hardware diodes. The telemetry simply cannot physically travel the other way. Now, of course, there can always be mistakes. Certification is supposed to catch that, but of course, that isn't fool proof either.
forapurpose 9y ago
> If anything were to happen, it definitely shouldn't affect the avionics, not even remotely, or the plane would not have had a chance of certification. Is that based on expectation, hope, or knowledge?
- tjr 9y ago
  In-flight entertainment would be categorized as DO-178B Level E software and DO-254 Level E hardware: https://en.wikipedia.org/wiki/DO-178B#Software_level https://en.wikipedia.org/wiki/DO-178B#Software_level https://en.wikipedia.org/wiki/DO-254 https://en.wikipedia.org/wiki/DO-254 By definition, it should have no impact on "safety, aircraft operation, or crew workload". Mistakes can happen, but this is what is aimed for.
mseebach 9y ago
> definitely shouldn't affect the avionics No, and the flaw you're busy exploiting also definitely shouldn't be there. (Yes, the IFE is probably airgapped. Probably.)
- bonzini 9y ago
  Since when are web servers DO-178 certified?
  - mseebach 9y ago
    Wild guess: Roughly about the time they began being used in IFE systems?
    - bonzini 9y ago
      Not at levels A-D, which are the ones where the faults "should not be there" (citing the parent comment). At level E you only have to prove that there's no effects of faults on safety-critical systems, so it's more about the surrounding architecture than the software itself.
- ricardobeat 9y ago
  What flaw? He was merely querying a public http API and scanning for ports.
mulmen 9y ago
The only way to know that you won't crash a critical system is to try it. You're right you shouldn't be able to but that doesn't mean it can't be done. Doing this in flight is still dangerous.

Tuxer 9y ago

500k lb, at the very least :)